Hack attack targets cash machine jackpot

 

Gallery

By Reuters

Posted on 28 Jun 2010 at 08:06

A security expert says flaws in the design of some cash machines make them vulnerable to hackers, who could make the cash dispensers spit out their cash contents.

Barnaby Jack, head of research at security firm IOActive Labs, will demonstrate methods for "jackpotting" ATMs at the Black Hat security conference next month.

“ATMs are not as secure as we would like them to be,” said Jeff Moss, founder of the Black Hat conference. “Barnaby has a number of different attacks that make all the money come out.”

Jack declined to discuss his techniques before the conference, but his comments will send bank security staff into a panic.

If the attacks are as effective as Jack claims then making them public would allow crooks to adopt his methods, but Moss said that going public would raise awareness of the problem among ATM operators and prompt them to tighten security.

One potential route of attack is via communications ports that are sometimes accessible from outside an ATM, Moss said.

“You want everybody to know there are possible ways to jackpot these machines, so they will go and get their machines updated,” he said.

Joe Grand, a hardware security expert, said he was not surprised to learn of Jack's research.

“People are starting to realise that hardware products do have security vulnerabilities. Parking meters, ATMs, everything that has electronics in it can be broken,” Grand said. “A lot of times a hardware product is just a computer in a different shell.”